Windows Vista: Festplatte wird zugemüllt, ist das ein Virus oder Systemfehler?

IchMephisto · 06.12.2014, 20:09

Hallo,

meine Festplatte auf Laufwerk C füllt sich seit einiger Zeit von selbst, wenn ich eine Datenträgerbereinigung durchführe, werden immer nur wenige MB oder sogar kb freigegeben.
Beim Virenscan werden keine Sicherheitsrisiken erkannt und die Grafiktreiberkarte funktioniert auch.
Ich habe eigentlich einen Arbeitsspeicher von 2046 MB und belege mit Daten nur 17GB und das schon seit Jahren. Zusätzlich hatte ich den Lappie im Oktober neu aufgesetzt. Das Problem tritt aber erst seit Ende November auf.

Ich hatte versucht, eurer Anweisung zu folgen, habe die defogger und frst Logfiles erstellen können, aber GMER war/ist problematisch. Wenn ich die Internetverbindung getrennt hatte, stürzte mir der Lappie x-mal an unterschiedlichen Stellen mit und ohne Bluescreen ab. Bei einem Versuch hatte ich versehentlich die Internetverbindung nicht gekappt und da lief der Scan durch.

Ich könnte dringend Hilfe gebrauchen, da ich etwas nervös an meiner Abschlußarbeit schreibe und so nicht weiterarbeiten kann.

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:34 on 06/12/2014 (Sarina)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-12-2014
Ran by Sarina (administrator) on SARINA-PC on 06-12-2014 15:36:28
Running from C:\Users\Sarina\Desktop
Loaded Profile: Sarina (Available profiles: Sarina)
Platform: Microsoft® Windows Vista™ Home Premium  (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Symantec Corporation) C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
(Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Chicony) C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
() C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccApp.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
(Interactive Digital Media) C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Toshiba) C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Symantec Corporation) C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
(Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe
(PortableApps.com) C:\Users\Sarina\Firefox Browser\FirefoxPortable.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynToshiba.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
(Mozilla Corporation) C:\Users\Sarina\Firefox Browser\App\Firefox\firefox.exe
(Mozilla Corporation) C:\Users\Sarina\Firefox Browser\App\Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-08-27] (Microsoft Corporation)
HKLM\...\Run: [Camera Assistant Software] => C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [413696 2007-05-22] (Chicony)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [411192 2007-03-29] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [55416 2006-12-07] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [509496 2007-04-03] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [538744 2007-05-22] (TOSHIBA Corporation)
HKLM\...\Run: [KeNotify] => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [34352 2006-11-06] ()
HKLM\...\Run: [HWSetup] => \HWSetup.exe hwSetUP
HKLM\...\Run: [SVPWUTIL] => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe [438272 2006-03-22] (TOSHIBA)
HKLM\...\Run: [NDSTray.exe] => NDSTray.exe
HKLM\...\Run: [ccApp] => C:\Program Files\Common Files\Symantec Shared\ccApp.exe [115816 2007-01-09] (Symantec Corporation)
HKLM\...\Run: [topi] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [581632 2007-07-10] (TOSHIBA)
HKLM\...\Run: [Desktop SMS] => C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe [1507328 2007-06-18] (Interactive Digital Media)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4702208 2007-09-03] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [894512 2007-06-08] (Synaptics, Inc.)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe [571024 2007-05-04] (Toshiba)
HKLM\...\Run: [Symantec PIF AlertEng] => C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [583048 2008-01-29] (Symantec Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-03-11] (Hewlett-Packard Co.)
HKLM\...\Run: [ALUAlert] => C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe [484984 2007-01-10] (Symantec Corporation)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3232240304-646353090-492334816-1000\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [436088 2007-06-27] ()
HKU\S-1-5-21-3232240304-646353090-492334816-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [201728 2006-11-02] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
BHO: HP Print Clips -> {053F9267-DC04-4294-A72C-58F732D338C0} -> C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name -> {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -> C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll (Symantec Corporation)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll (Symantec Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()

Chrome: 
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Automatisches LiveUpdate - Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [554616 2007-01-10] (Symantec Corporation)
R2 ccEvtMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108648 2007-01-09] (Symantec Corporation)
R2 ccSetMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108648 2007-01-09] (Symantec Corporation)
R2 CFSvcs; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2006-11-14] (TOSHIBA CORPORATION) [File not signed]
R2 CLTNetCnService; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108648 2007-01-09] (Symantec Corporation)
S3 comHost; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [49248 2007-01-12] (Symantec Corporation)
S3 FirebirdServerMAGIXInstance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-03-11] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [131072 2007-03-11] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S3 ISPwdSvc; C:\Program Files\Norton Internet Security\isPwdSvc.exe [80504 2007-01-14] (Symantec Corporation)
S3 LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE [2918008 2007-01-10] (Symantec Corporation)
R2 LiveUpdate Notice Ex; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108648 2007-01-09] (Symantec Corporation)
S2 LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [583048 2008-01-29] (Symantec Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2006-11-08] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2006-11-08] (Hewlett-Packard) [File not signed]
S3 Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [1251720 2014-10-16] ()
R2 SymAppCore; C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [47712 2007-01-05] (Symantec Corporation)
R2 TNaviSrv; C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [77824 2007-06-28] (TOSHIBA Corporation) [File not signed]
R2 TODDSrv; C:\Windows\system32\TODDSrv.exe [114688 2006-05-25] (TOSHIBA Corporation) [File not signed]
R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 CplIR; C:\Windows\System32\DRIVERS\CplIR.SYS [14848 2007-03-06] (COMPAL ELECTRONIC INC.)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-09-24] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-09-24] (Symantec Corporation)
R1 IDSvix86; C:\ProgramData\Symantec\Definitions\SymcData\idsdefs\20141202.001\IDSvix86.sys [287792 2014-09-16] (Symantec Corporation)
R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [19456 2006-07-28] (COMPAL ELECTRONIC INC.)
R3 NAVENG; C:\ProgramData\Symantec\Definitions\VirusDefs\20141110.003\NAVENG.SYS [95704 2014-09-24] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Symantec\Definitions\VirusDefs\20141110.003\NAVEX15.SYS [1636696 2014-09-24] (Symantec Corporation)
R1 SPBBCDrv; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [418104 2007-04-14] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [279088 2007-11-30] (Symantec Corporation)
S3 SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [317616 2007-11-30] (Symantec Corporation)
R1 SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [43696 2007-11-30] (Symantec Corporation)
R3 SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [12720 2009-08-03] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [124464 2014-12-03] (Symantec Corporation)
R3 SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [145968 2009-08-03] (Symantec Corporation)
R3 SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [39856 2009-08-03] (Symantec Corporation)
R3 SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [38448 2009-08-03] (Symantec Corporation)
R3 SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [26416 2009-08-03] (Symantec Corporation)
R1 SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [188080 2009-08-03] (Symantec Corporation)
R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [11776 2007-04-16] (Chicony Electronics Co., Ltd.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 Tosrfcom; No ImagePath
S3 TpChoice; system32\DRIVERS\TpChoice.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-06 15:36 - 2014-12-06 15:36 - 00014477 _____ () C:\Users\Sarina\Desktop\FRST.txt
2014-12-06 15:36 - 2014-12-06 15:36 - 00000000 ____D () C:\FRST
2014-12-06 15:35 - 2014-12-06 15:35 - 01110016 _____ (Farbar) C:\Users\Sarina\Desktop\FRST.exe
2014-12-06 15:34 - 2014-12-06 15:34 - 00000474 _____ () C:\Users\Sarina\Desktop\defogger_disable.log
2014-12-06 15:34 - 2014-12-06 15:34 - 00000000 _____ () C:\Users\Sarina\defogger_reenable
2014-12-06 15:33 - 2014-12-06 15:33 - 00050477 _____ () C:\Users\Sarina\Desktop\Defogger.exe
2014-12-06 13:54 - 2014-12-06 13:54 - 206301581 _____ () C:\Windows\MEMORY.DMP
2014-12-06 13:54 - 2014-12-06 13:54 - 00138520 _____ () C:\Windows\Minidump\Mini120614-01.dmp
2014-12-06 10:44 - 2014-12-06 14:24 - 00000000 ____D () C:\Users\Sarina\AppData\Roaming\Mozilla
2014-12-03 14:19 - 2014-12-03 14:19 - 00600388 _____ () C:\Users\Sarina\Desktop\frus1961-63v06.mobi
2014-12-02 11:59 - 2014-12-02 11:59 - 00000310 _____ () C:\Windows\Tasks\WebReg Photosmart C4200 series.job
2014-11-24 11:55 - 2014-11-24 11:55 - 00158135 ____N () C:\Windows\hpoins15.dat.temp
2014-11-24 11:55 - 2007-06-06 00:04 - 00001039 ____N () C:\Windows\hpomdl15.dat.temp
2014-11-23 17:35 - 2014-11-23 17:48 - 00000000 ____D () C:\AdwCleaner
2014-11-06 20:14 - 2014-11-06 20:14 - 00019713 _____ () C:\Users\Sarina\Desktop\bookmarks.html
2014-11-06 17:27 - 2014-11-06 17:27 - 00000000 ____D () C:\Neuer Ordner
2014-11-06 17:08 - 2014-11-24 15:55 - 00004320 _____ () C:\Windows\setupact.log
2014-11-06 17:08 - 2014-11-06 17:08 - 00000000 _____ () C:\Windows\setuperr.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-06 15:34 - 2014-10-15 14:30 - 00000000 ____D () C:\Users\Sarina
2014-12-06 15:19 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-06 15:19 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-06 15:14 - 2014-10-21 20:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-06 14:25 - 2014-10-15 14:16 - 01920052 _____ () C:\Windows\WindowsUpdate.log
2014-12-06 14:19 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-06 14:06 - 2006-11-02 14:01 - 00032524 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-06 13:54 - 2014-11-01 22:13 - 00000000 ____D () C:\Windows\Minidump
2014-12-06 13:53 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-12-06 13:53 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-12-06 13:53 - 2006-11-02 11:22 - 27262976 _____ () C:\Windows\system32\config\software_previous
2014-12-06 13:53 - 2006-11-02 11:22 - 15466496 _____ () C:\Windows\system32\config\system_previous
2014-12-06 13:52 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-12-06 13:52 - 2006-11-02 11:22 - 16252928 _____ () C:\Windows\system32\config\components_previous
2014-12-06 13:52 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-12-06 12:09 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-12-06 07:45 - 2014-10-15 15:52 - 00000420 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{4ADB76EE-C28E-4CCF-98E4-B8814B4A6F77}.job
2014-12-06 07:44 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-12-05 23:05 - 2007-08-27 18:40 - 00000000 ____D () C:\ProgramData\Symantec
2014-12-05 11:35 - 2014-10-22 17:11 - 00000000 ____D () C:\Users\Sarina\Documents\AAAA Magisterarbeit 2014
2014-12-03 17:00 - 2007-08-27 18:30 - 00077734 _____ () C:\Windows\PFRO.log
2014-12-03 16:54 - 2007-08-27 18:41 - 00124464 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS
2014-12-03 16:54 - 2007-08-27 18:41 - 00010635 _____ () C:\Windows\system32\Drivers\SYMEVENT.CAT
2014-12-03 16:54 - 2007-08-27 18:40 - 00000000 ____D () C:\Program Files\Symantec
2014-12-03 16:53 - 2007-08-27 18:42 - 00000000 ____D () C:\Program Files\Norton Internet Security
2014-12-01 23:12 - 2014-10-16 07:52 - 00000584 _____ () C:\Windows\Tasks\Norton Internet Security - Systemprüfung ausführen - Sarina.job
2014-12-01 20:05 - 2014-10-16 08:54 - 00000016 _____ () C:\Windows\system32\coh.cache
2014-11-26 19:56 - 2006-11-02 11:33 - 01461736 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-26 19:17 - 2014-10-21 20:24 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-26 19:17 - 2014-10-21 20:24 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-24 15:56 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\twain_32
2014-11-24 14:26 - 2014-11-01 11:42 - 00000000 ____D () C:\Users\Sarina\Documents\Rezepte
2014-11-24 11:59 - 2014-10-18 12:20 - 00003162 _____ () C:\ProgramData\hpzinstall.log
2014-11-24 11:59 - 2014-10-18 12:19 - 00158256 _____ () C:\Windows\hpoins15.dat
2014-11-24 11:58 - 2006-11-02 11:23 - 00000179 _____ () C:\Windows\win.ini
2014-11-19 16:37 - 2014-10-24 19:53 - 00012288 _____ () C:\Users\Sarina\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-13 10:58 - 2014-10-15 17:50 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-13 10:48 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Some content of TEMP:
====================
C:\Users\Sarina\AppData\Local\Temp\Quarantine.exe
C:\Users\Sarina\AppData\Local\Temp\sqlite3.dll
C:\Users\Sarina\AppData\Local\Temp\symlcsv1.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-06 14:27

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 06-12-2014
Ran by Sarina at 2014-12-06 15:37:15
Running from C:\Users\Sarina\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 1.0.0 - Hewlett-Packard) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Reader 8 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A80000000002}) (Version: 8.0.0 - Adobe Systems Incorporated)
AIO_Scan (Version: 90.0.200.000 - Hewlett-Packard) Hidden
AppCore (Version: 1 - Symantec Corporation) Hidden
Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros)
ATI Catalyst Install Manager (HKLM\...\{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}) (Version: 3.0.641.0 - ATI Technologies, Inc.)
AV (Version: 1 - Symantec Corporation) Hidden
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v5.10.14(T) - )
BufferChm (Version: 90.0.146.000 - Hewlett-Packard) Hidden
C4200 (Version: 90.0.200.000 - Hewlett-Packard) Hidden
C4200_doccd (Version: 90.0.200.000 - Hewlett-Packard) Hidden
c4200_Help (Version: 90.0.200.000 - Hewlett-Packard) Hidden
Camera Assistant Software for Toshiba (HKLM\...\{37C866E4-AA67-4725-9E95-A39968DD7960}) (Version: 1.7.148.0720 - Chicony Electronics Co.,Ltd.)
Catalyst Control Center - Branding (HKLM\...\{22543949-70E8-45D0-A938-F38143EB8BF8}) (Version: 1.00.0000 - ATI)
ccc-core-static (Version: 2007.0621.1715.28924 - Ihr Firmenname) Hidden
ccCommon (Version: 106.2.0.21 - Symantec) Hidden
CD/DVD Drive Acoustic Silencer (HKLM\...\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}) (Version: 2.01.03 - TOSHIBA)
Copy (Version: 90.0.146.000 - Hewlett-Packard) Hidden
CustomerResearchQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
Desktop SMS (HKLM\...\{5980B928-1C95-4B3E-957B-B02D8147FF9E}) (Version: 1.2.0 - IDM)
Destination Component (Version: 090.000.091.086 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 90.0.146.000 - Hewlett-Packard) Hidden
DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
DocProc (Version: 9.0.0.0 - Hewlett-Packard) Hidden
DocProcQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
DVD MovieFactory for TOSHIBA (HKLM\...\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}) (Version: 5.3 - Ulead Systems, Inc.)
Emdedded IR Driver (HKLM\...\InstallShield_{A6D4234C-CB02-4048-AC3E-AD09404FA35A}) (Version: 0.0.0.6C - Compal Electronics, Inc.)
Emdedded IR Driver (Version: 0.0.0.6C - Compal Electronics, Inc.) Hidden
eSupportQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
Firebird SQL Server - MAGIX Edition 2.0.0.1 (D) (HKLM\...\Firebird SQL Server D) (Version: 2.0.0.1 - MAGIX AG)
Firefox Browser (remove only) (HKLM\...\Firefox Browser) (Version:  - )
HP Customer Participation Program 9.0 (HKLM\...\HPExtendedCapabilities) (Version: 9.0 - HP)
HP Imaging Device Functions 9.0 (HKLM\...\HP Imaging Device Functions) (Version: 9.0 - HP)
HP OCR Software 9.0 (HKLM\...\HPOCR) (Version: 9.0 - HP)
HP Photosmart All-In-One Software 9.0 (HKLM\...\{B22C19AE-6A67-4f28-B541-5AE72FB17A25}) (Version: 9.0 - HP)
HP Photosmart Essential 2.01 (HKLM\...\HP Photosmart Essential) (Version: 2.01 - HP)
HP Smart Web Printing (HKLM\...\{415CDA53-9100-476F-A7B2-476691E117C7}) (Version: 2.15.7.0 - Ihr Firmenname)
HP Solution Center 9.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 9.0 - HP)
HP Update (HKLM\...\{8C6027FD-53DC-446D-BB75-CACD7028A134}) (Version: 4.000.006.002 - Hewlett-Packard)
HPProductAssistant (Version: 90.0.146.000 - Hewlett-Packard) Hidden
HPSSupply (HKLM\...\{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}) (Version: 2.2.0.0000 - Ihr Firmenname)
Java(TM) SE Runtime Environment 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160000}) (Version: 1.6.0.0 - Sun Microsystems, Inc.)
LiveUpdate 3.2 (Symantec Corporation) (HKLM\...\LiveUpdate) (Version: 3.2.0.41 - Symantec Corporation)
LiveUpdate Notice (Symantec Corporation) (HKLM\...\{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}) (Version: 1.4.5 - Symantec Corporation)
MAGIX Digital Foto Maker SE 4.1.0.835 (D) (HKLM\...\MAGIX Digital Foto Maker SE D) (Version: 4.1.0.835 - MAGIX AG)
MAGIX Foto Suite 1.12.0.89 (D) (HKLM\...\MAGIX Foto Suite D) (Version: 1.12.0.89 - MAGIX AG)
MAGIX Online Druck Service 2.3.2.0 (D) (HKLM\...\MAGIX Online Druck Service D) (Version: 2.3.2.0 - MAGIX AG)
MarketResearch (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
MSRedist (Version: 1.0.0.0 - Symantec Corporation) Hidden
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
myphotobook 3.1 (HKLM\...\myphotobook) (Version: 3.1 - myphotobook)
Norton AntiVirus (Version: 14.2.0.29 - Symantec Corporation) Hidden
Norton Confidential Browser Component (Version: 1.5.0.29 - Symantec Corporation) Hidden
Norton Confidential Web Protection Component (Version: 1.5.0.29 - Symantec Corporation) Hidden
Norton Internet Security (Symantec Corporation) (HKLM\...\SymSetup.{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}) (Version: 10.2.0.30 - Symantec Corporation)
Norton Internet Security (Version: 10.1.0 - Symantec Corp.) Hidden
Norton Internet Security (Version: 10.2.0.30 - Symantec Corporation) Hidden
Norton Protection Center (Version: 2007.2.0.22 - Symantec Corporation) Hidden
OpenOffice 4.1.1 (HKLM\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
PS_AIO_ProductContext (Version: 90.0.200.000 - Hewlett-Packard) Hidden
PS_AIO_Software (Version: 90.0.200.000 - Hewlett-Packard) Hidden
PS_AIO_Software_min (Version: 90.0.200.000 - Hewlett-Packard) Hidden
PSSWCORE (Version: 2.01.0000 - Hewlett-Packard) Hidden
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5477 - Realtek Semiconductor Corp.)
Scan (Version: 9.0.0.0 - Hewlett-Packard) Hidden
Skins (Version: 2007.0621.1715.28924 - ATI) Hidden
SolutionCenter (Version: 90.0.146.000 - Hewlett-Packard) Hidden
SPBBC 32bit (Version: 3.2.0.21 - Symantec Corporation) Hidden
Status (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Symantec Real Time Storage Protection Component (Version: 10.2.2.6 - Symantec Corporation) Hidden
SymNet (Version: 7.2.5.8 - Symantec Corporation) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.0.1.0 - Synaptics)
Texas Instruments PCIxx21/x515/xx12 drivers. (HKLM\...\InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}) (Version: 2.00.0001 - Ihr Firmenname)
TIPCI (Version: 2.00.0001 - Ihr Firmenname) Hidden
Toolbox (Version: 90.0.146.000 - Hewlett-Packard) Hidden
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.04 - TOSHIBA)
TOSHIBA Benutzerhandbücher (HKLM\...\{56995235-B76E-44A6-BA17-8FF13D3F907A}) (Version: 7.30 - TOSHIBA)
TOSHIBA ConfigFree (HKLM\...\{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}) (Version: 7.00.32 - TOSHIBA)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.0.0.8 - TOSHIBA Corporation)
TOSHIBA DVD PLAYER (HKLM\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 1.10.06 - TOSHIBA Corporation)
TOSHIBA Extended Tiles for Windows Mobility Center (HKLM\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version: 1.01.00 - Toshiba)
TOSHIBA Flash Cards Support Utility (HKLM\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.52.0.2C - TOSHIBA)
TOSHIBA Hardware Setup (HKLM\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.52.0.2C - TOSHIBA)
Toshiba Online Product Information (HKLM\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 1.00.0012 - TOSHIBA)
TOSHIBA SD Memory Utilities (HKLM\...\{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}) (Version: 1.8.1.1 - TOSHIBA)
TOSHIBA Software Modem (HKLM\...\TOSHIBA Software Modem) (Version: 2.1.77 (SM2177ALD04) - Agere Systems)
TOSHIBA Supervisorkennwort (HKLM\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.52.0.2C - TOSHIBA)
TOSHIBA Value Added Package (HKLM\...\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}) (Version: 1.0.28 - TOSHIBA Corporation)
TrayApp (Version: 90.0.146.000 - Hewlett-Packard) Hidden
UnloadSupport (Version: 9.0.0 - Hewlett-Packard) Hidden
Utility Common Driver (Version: 0.0.1.1C - TOSHIBA) Hidden
VideoToolkit01 (Version: 90.0.146.000 - Hewlett-Packard) Hidden
WebReg (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Windows Media Encoder 9-Reihe (HKLM\...\Windows Media Encoder 9) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

06-12-2014 09:44:00 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3EEFD7D7-FB61-45B1-B9CC-2D1D0859FA5D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {4C131055-6792-4A0E-80D6-1F7F1334A082} - System32\Tasks\Norton Internet Security - Systemprüfung ausführen - Sarina => C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-01-14] (Symantec Corporation)
Task: {D54C4670-288F-4479-8470-1085A56176CD} - System32\Tasks\WebReg Photosmart C4200 series => C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11] (Hewlett-Packard Co.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Norton Internet Security - Systemprüfung ausführen - Sarina.job => C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{4ADB76EE-C28E-4CCF-98E4-B8814B4A6F77}.job => C:\Windows\system32\msfeedssync.exe
Task: C:\Windows\Tasks\WebReg Photosmart C4200 series.job => C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe

==================== Loaded Modules (whitelisted) =============

2007-01-18 08:30 - 2007-01-18 08:30 - 00094208 _____ () C:\Program Files\IDM\Desktop SMS\oehook.dll
2007-01-17 17:08 - 2007-01-17 17:08 - 00009336 _____ () C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVShExt.loc
2007-08-27 16:19 - 2007-06-21 16:27 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2007-05-31 15:38 - 2007-05-31 15:38 - 00958464 _____ () C:\Program Files\TOSHIBA\FlashCards\de\TCrdMain.resources.dll
2006-11-09 17:27 - 2006-11-09 17:27 - 00090112 _____ () C:\Program Files\TOSHIBA\FlashCards\TWarnMsg\TWarnMsg.dll
2007-08-27 18:20 - 2006-10-10 10:44 - 00009728 _____ () C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll
2006-11-08 18:08 - 2006-11-08 18:08 - 00009216 _____ () C:\Program Files\Toshiba\PCDiag\NotifyPCD.dll
2006-10-07 11:57 - 2006-10-07 11:57 - 00053248 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2006-12-01 17:55 - 2006-12-01 17:55 - 00009216 _____ () C:\Program Files\Toshiba\TBS\NotifyTBS.dll
2006-11-06 16:14 - 2006-11-06 16:14 - 00034352 _____ () C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
2007-08-27 18:21 - 2007-06-27 11:28 - 00436088 _____ () C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
2007-05-31 09:12 - 2007-05-31 09:12 - 00016384 ____R () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2007-08-27 17:44 - 2007-07-19 15:27 - 04765184 _____ () C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
2014-12-06 14:23 - 2014-12-06 14:23 - 00029696 _____ () C:\Users\Sarina\AppData\Local\Temp\nsmD866.tmp\registry.dll
2014-12-06 14:23 - 2014-12-06 14:23 - 00008704 _____ () C:\Users\Sarina\AppData\Local\Temp\nsmD866.tmp\newadvsplash.dll
2014-12-06 14:23 - 2014-12-06 14:23 - 00011264 _____ () C:\Users\Sarina\AppData\Local\Temp\nsmD866.tmp\System.dll
2014-03-15 09:40 - 2014-11-12 15:16 - 03649648 _____ () C:\Users\Sarina\Firefox Browser\App\firefox\mozjs.dll
2014-11-26 19:17 - 2014-11-26 19:17 - 16841392 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-3232240304-646353090-492334816-500 - Administrator - Disabled)
Gast (S-1-5-21-3232240304-646353090-492334816-501 - Limited - Disabled)
Sarina (S-1-5-21-3232240304-646353090-492334816-1000 - Administrator - Enabled) => C:\Users\Sarina

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/06/2014 03:19:43 PM) (Source: WerSvc) (EventID: 5007) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/06/2014 02:05:50 PM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (12/06/2014 08:39:23 AM) (Source: WerSvc) (EventID: 5007) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/05/2014 09:14:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm AcroRd32.exe, Version 8.0.0.456 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: c0c
Anfangszeit: 01d010c7d265cbb5
Zeitpunkt der Beendigung: 16

Error: (12/05/2014 08:54:39 PM) (Source: WerSvc) (EventID: 5007) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/05/2014 07:29:49 PM) (Source: WerSvc) (EventID: 5007) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/05/2014 11:35:38 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEs steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.

Error: (12/05/2014 10:25:41 AM) (Source: WerSvc) (EventID: 5007) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/05/2014 08:01:39 AM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (12/04/2014 09:42:47 PM) (Source: System Restore) (EventID: 8210) (User: )
Description: Der geplante Wiederherstellungspunkt konnte nicht erstellt werden. Zusätzliche Informationen: (0x8004231f).


System errors:
=============
Error: (12/06/2014 02:21:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/06/2014 02:19:35 PM) (Source: atikmdag) (EventID: 10266) (User: )
Description: Unknown EDID version

Error: (12/06/2014 02:19:35 PM) (Source: atikmdag) (EventID: 10266) (User: )
Description: Unknown EDID version

Error: (12/06/2014 02:19:35 PM) (Source: atikmdag) (EventID: 10266) (User: )
Description: Unknown EDID version

Error: (12/06/2014 02:19:34 PM) (Source: Microsoft-Windows-Kernel-WHEA) (EventID: 10) (User: NT-AUTORITÄT)
Description: 031533181585092852129136617444350455200010000000001000100000002000000E8020000D23DFB455711D001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FE6FF5E89C91C54CBA8865ABE14913BB01000000000000000200000000000000000000000000000000000000000000000000000000000000D0000000180200000001000001000000E95412E7B9C14049AB76909703A4320F00000000000000000000000000000000010000000000000000000000000000000000000000000000457250740100000018020000000000000001000000000000000000000000000000000000010000000000000000000000000000000200000001000000000000007F010000000000000000030000030000810F0600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000100000001000000D23DFB455711D00101000000000000000100000000000000FFFFFFFFBEE7BFFFFD7FBFABFCFBFFFB00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Error: (12/06/2014 02:19:24 PM) (Source: ACPI) (EventID: 6) (User: )
Description: IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz 5, Funktion 0. 
Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.

Error: (12/06/2014 02:19:24 PM) (Source: ACPI) (EventID: 6) (User: )
Description: IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz 7, Funktion 0. 
Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.

Error: (12/06/2014 02:19:24 PM) (Source: ACPI) (EventID: 6) (User: )
Description: IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz 6, Funktion 0. 
Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.

Error: (12/06/2014 02:19:24 PM) (Source: ACPI) (EventID: 6) (User: )
Description: IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz 2, Funktion 0. 
Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.

Error: (12/06/2014 02:05:48 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}


Microsoft Office Sessions:
=========================
Error: (12/06/2014 03:19:43 PM) (Source: WerSvc) (EventID: 5007) (User: )
Description: 8014FFF9

Error: (12/06/2014 02:05:50 PM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (12/06/2014 08:39:23 AM) (Source: WerSvc) (EventID: 5007) (User: )
Description: 8014FFF9

Error: (12/05/2014 09:14:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: AcroRd32.exe8.0.0.456c0c01d010c7d265cbb516

Error: (12/05/2014 08:54:39 PM) (Source: WerSvc) (EventID: 5007) (User: )
Description: 8014FFF9

Error: (12/05/2014 07:29:49 PM) (Source: WerSvc) (EventID: 5007) (User: )
Description: 8014FFF9

Error: (12/05/2014 11:35:38 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEs steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.

Error: (12/05/2014 10:25:41 AM) (Source: WerSvc) (EventID: 5007) (User: )
Description: 8014FFF9

Error: (12/05/2014 08:01:39 AM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (12/04/2014 09:42:47 PM) (Source: System Restore) (EventID: 8210) (User: )
Description: 0x8004231f


==================== Memory info =========================== 

Processor: AMD Turion(tm) 64 X2 Mobile Technology TL-64
Percentage of memory in use: 61%
Total physical RAM: 2045.44 MB
Available physical RAM: 778.45 MB
Total Pagefile: 4309.2 MB
Available Pagefile: 2868.39 MB
Total Virtual: 2047.88 MB
Available Virtual: 1914.72 MB

==================== Drives ================================

Drive c: (Vista) (Fixed) (Total:92.77 GB) (Free:0.44 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data) (Fixed) (Total:92.07 GB) (Free:77.78 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 186.3 GB) (Disk ID: 4D9E95D1)
Partition 1: (Not Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Active) - (Size=92.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=92.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 186.3 GB) (Disk ID: 5D379805)
Partition 1: (Not Active) - (Size=186.3 GB) - (Type=OF Extended)

==================== End Of Log ============================

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-06 17:08:12
Windows 6.0.6000  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK2035GSS rev.DK020M 186,31GB
Running: Gmer-19357.exe; Driver: C:\Users\Sarina\AppData\Local\Temp\pwlyqpod.sys


---- System - GMER 2.1 ----

SSDT     86852B98                                                                                           ZwAlertResumeThread
SSDT     86852C78                                                                                           ZwAlertThread
SSDT     86757B88                                                                                           ZwAllocateVirtualMemory
SSDT     866A58B8                                                                                           ZwConnectPort
SSDT     867BD348                                                                                           ZwCreateMutant
SSDT     866A5DF8                                                                                           ZwCreateThread
SSDT     8673F350                                                                                           ZwFreeVirtualMemory
SSDT     867BD418                                                                                           ZwImpersonateAnonymousToken
SSDT     86852AB8                                                                                           ZwImpersonateThread
SSDT     8673F270                                                                                           ZwMapViewOfSection
SSDT     867BD268                                                                                           ZwOpenEvent
SSDT     86744430                                                                                           ZwOpenProcessToken
SSDT     8679AE28                                                                                           ZwOpenThreadToken
SSDT     867C6D40                                                                                           ZwResumeThread
SSDT     86757B08                                                                                           ZwSetContextThread
SSDT     8679AEF8                                                                                           ZwSetInformationProcess
SSDT     867BB398                                                                                           ZwSetInformationThread
SSDT     867CD008                                                                                           ZwSuspendProcess
SSDT     867BB230                                                                                           ZwSuspendThread
SSDT     86523E88                                                                                           ZwTerminateProcess
SSDT     8673F1F0                                                                                           ZwTerminateThread
SSDT     8679A458                                                                                           ZwUnmapViewOfSection
SSDT     867428D0                                                                                           ZwWriteVirtualMemory

---- Kernel code sections - GMER 2.1 ----

.text    C:\Windows\system32\DRIVERS\tos_sps32.sys                                                          section is writeable [0x8780B000, 0x4036D, 0xE8000020]
.dsrt    C:\Windows\system32\DRIVERS\tos_sps32.sys                                                          unknown last section [0x87854000, 0x510, 0x40000040]

---- User code sections - GMER 2.1 ----

.text    C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe[2768] ntdll.dll!DbgBreakPoint  77492EA8 1 Byte  [90]

---- Processes - GMER 2.1 ----

Process   (*** hidden *** )                                                                                 [4] 83839830                                            

---- EOF - GMER 2.1 ----

schrauber · 06.12.2014, 20:36

hi,

TreeSize Free Download

Bitte mal Treesize laden und ausführen. Warten bis das Tool mit der Analyse fertig ist, dann davon einen Screenshot.

IchMephisto · 06.12.2014, 22:11

Hallo Schrauber,

danke für die rasche Reaktion, ich habe mich gleich ein bisschen besser gefühlt :-)
Anbei ich die Screenshots angehängt.

schrauber · 07.12.2014, 20:58

Ordner ProgramData mit dem Pluszeichen vorne dran solange aufklappen, bis man die letzte Ebene Ordner oder Datei sieht, die soviel Platz frisst.

IchMephisto · 07.12.2014, 21:10

Ist der Screenshot besser?

IchMephisto · 07.12.2014, 21:25

Gelöscht

IchMephisto · 07.12.2014, 21:35

Sorry, da ging was schief beim hochladen - ich vermute, du wolltest eigentlich den anhang treesizevirusdefaufgeklappt haben. Ich fand die Ansichten beim Aufklappen der Ordner etwas verwirrend.

schrauber · 08.12.2014, 20:21

wie ich mir schon dachte.....Syman-Dreck, ehm Symantec.

Deinstalliere den Norton-Abfall und erfreue dich deines freien Speicherplatzes

IchMephisto · 09.12.2014, 17:08

Hat funktioniert!

Ich habe mir jetzt wieder Avira geholt und bislang sieht alles wieder normal aus auf meiner Festplatte.
Rein interessehalber, falls es den Hilfethread nicht sprengt, warum hat Norton dieses Problem verursacht?

schrauber · 10.12.2014, 13:42

Die Signaturen wurden nicht bereinigt. GLeiches Problem hatte ich schon mal mit KAspersky.

Aber Avira?

IchMephisto · 10.12.2014, 19:12

Aha, wieder was gelernt. Was stimmt denn nicht mit Avira? Hättest du eine andere Empfehlung?

schrauber · 11.12.2014, 19:49

Lesestoff:
Warum wir Avira nicht mehr empfehlen
Avira liefert seit einiger Zeit mit der Standardinstallation die Ask Toolbar mit aus. Diese Toolbar ist Voraussetzung dafür, dass der Webguard zuverlässig funktioniert. Die Ask Toolbar ist dafür bekannt, dass sie das Surfverhalten des Benutzers ausspioniert, um damit in letzter Konsequenz Geld zu verdienen. Daher wird von uns auf diesem Board als "schädlich" eingestuft. Mehr Informationen.

Eine Sicherheitsfirma, die dem Benutzer praktisch ungefragt schädliche Software "unterjubelt", scheidet für uns daher aus. Wir empfehlen daher allen Nutzern von Avira aufgrund dieser Geschäftspraktik, der teilweise äußerst schlechten Erkennungsrate und der überaus nervtötenden Werbung Avira zu deinstallieren und auf ein alternatives Produkt auszuweichen.

Solltest du dich zu einem Wechsel entscheiden, empfehlen wir dir nach der Deinstallation mit dem Avira-Cleaner alle Reste zu entfernen.

Ich empfehle immer Emsisoft

IchMephisto · 11.12.2014, 22:46

Oha, das wusste ich nicht über Avira. Aber bei Emisoft fehlt der Schutz gegen Neuinfektionen nach der Testphase, ist das net ein ziemliches Manko?

schrauber · 12.12.2014, 20:04

Ist halt kein kostenloses AV.

IchMephisto · 14.12.2014, 12:32

Alles klar. Auf jeden Fall danke für die schnelle und unkomplizierte Hilfestellung!

06.12.2014, 20:36	#2
schrauber /// the machine /// TB-Ausbilder	Windows Vista: Festplatte wird zugemüllt, ist das ein Virus oder Systemfehler? hi, TreeSize Free Download Bitte mal Treesize laden und ausführen. Warten bis das Tool mit der Analyse fertig ist, dann davon einen Screenshot. __________________ __________________

10.12.2014, 13:42	#10
schrauber /// the machine /// TB-Ausbilder	Windows Vista: Festplatte wird zugemüllt, ist das ein Virus oder Systemfehler? Die Signaturen wurden nicht bereinigt. GLeiches Problem hatte ich schon mal mit KAspersky. Aber Avira? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

12.12.2014, 20:04	#14
schrauber /// the machine /// TB-Ausbilder	Windows Vista: Festplatte wird zugemüllt, ist das ein Virus oder Systemfehler? Ist halt kein kostenloses AV. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows Vista: Festplatte wird zugemüllt, ist das ein Virus oder Systemfehler?

Plagegeister aller Art und deren Bekämpfung: Windows Vista: Festplatte wird zugemüllt, ist das ein Virus oder Systemfehler?